You're correct and this is done by design. We're not a security feature but a soft-monetization one.

99% of people aren't technical enough to go through any other way than retyping.